You can write a keylogger in pure CSS

Dupe: https://news.ycombinator.com/item?id=16422696

No, you can't.

You can uses CSS as part of a keylogger in conjunction with Javascript that triggers your selectors based on keypresses.

There are sites that already ship javascript that change attributes that trigger selectors on certain keypress events. So by adding 'pure css' to these sites one would be able to log keystrokes on certain fields.

One example is Instagram. It ships Javascript that changes suitable attributes of the password field on every keystroke. So adding the right CSS to Instagram could result in passwords being logged.

I don't see how this is an attack unless you load random third party stylesheets yourself. It's the webmaster's role to ensure that css sheets included on the website do not contact dodgy third party domains.

It also won't work on vanilla html inputs, it has to be controlled by javascript in which case the javascript already has access to this information anyway (and much more).

Does anyone know how this interacts with form auto-filling?

Why does CSS even have access to this stuff?

*with the use of JS